NVD

Id
17103  
Name
CVE-2016-0714  
Description
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-02-24  
Modified Date
2016-12-05  
Seq
2016-0714  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
94818 17103 CVE-2016-0714 SUSE-SU-2016:0769  View
94819 17103 CVE-2016-0714 SUSE-SU-2016:0822  View
94820 17103 CVE-2016-0714 SUSE-SU-2016:0839  View
94821 17103 CVE-2016-0714 openSUSE-SU-2016:0865  View
94822 17103 CVE-2016-0714 HPSBUX03561  View
94823 17103 CVE-2016-0714 RHSA-2016:1089  View
94824 17103 CVE-2016-0714 RHSA-2016:2045  View
94825 17103 CVE-2016-0714 20160222 [SECURITY] CVE-2016-0714 Apache Tomcat Security Manager Bypass  View
94826 17103 CVE-2016-0714 http://svn.apache.org/viewvc?view=revision&revision=1725263  View
94827 17103 CVE-2016-0714 http://svn.apache.org/viewvc?view=revision&revision=1725914  View
94828 17103 CVE-2016-0714 http://svn.apache.org/viewvc?view=revision&revision=1726196  View
94829 17103 CVE-2016-0714 http://svn.apache.org/viewvc?view=revision&revision=1726203  View
94830 17103 CVE-2016-0714 http://svn.apache.org/viewvc?view=revision&revision=1726923  View
94831 17103 CVE-2016-0714 http://svn.apache.org/viewvc?view=revision&revision=1727034  View
94832 17103 CVE-2016-0714 http://svn.apache.org/viewvc?view=revision&revision=1727166  View
94833 17103 CVE-2016-0714 http://svn.apache.org/viewvc?view=revision&revision=1727182  View
94834 17103 CVE-2016-0714 http://tomcat.apache.org/security-6.html  View
94835 17103 CVE-2016-0714 http://tomcat.apache.org/security-7.html  View
94836 17103 CVE-2016-0714 http://tomcat.apache.org/security-8.html  View
94837 17103 CVE-2016-0714 http://tomcat.apache.org/security-9.html  View
94838 17103 CVE-2016-0714 DSA-3530  View
94839 17103 CVE-2016-0714 DSA-3552  View
94840 17103 CVE-2016-0714 DSA-3609  View
94841 17103 CVE-2016-0714 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
94842 17103 CVE-2016-0714 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
94843 17103 CVE-2016-0714 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html  View
94844 17103 CVE-2016-0714 83327  View
94845 17103 CVE-2016-0714 1035069  View
94846 17103 CVE-2016-0714 USN-3024-1  View
94847 17103 CVE-2016-0714 RHSA-2016:1087  View
94848 17103 CVE-2016-0714 RHSA-2016:1088  View
94849 17103 CVE-2016-0714 https://bto.bluecoat.com/security-advisory/sa118  View
94850 17103 CVE-2016-0714 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964  View
94851 17103 CVE-2016-0714 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442  View
94852 17103 CVE-2016-0714 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
774 JVNDB-2016-001547 Apache Tomcat の Session Persistence の実装における SecurityManager の制限を回避される脆弱性 Apache Tomcat の Session Persistence の実装は、セッションの属性を誤って処理するため、SecurityManager の制限を回避され、特権付きコンテキスト内で任意のコードを実行される脆弱性が存在します。 CVE-2016-0714 86918 CVE-2016-0714 17103 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001547.html 2016-01-05 2016-11-22 View